- gate model selection on steering-placement image carriers from enqueue
until their steering/message event publishes; release the gate when an
admission ends idle without publication (both behaviorally asserted)
- reject session.updateQueue edits carrying non-text blocks at the RPC
boundary (queue edits cannot bypass image admission)
- extend the durable-directory walk past a first-created DSH_HOME to the
deepest pre-existing ancestor
- strip Windows-style separators from attachment display names on POSIX
- verify attachment reads with a header-only probe (digest already proves
the bytes decoded fully at admission); document the read path
- make SessionInputShell.addImages refusal observable and keep workspace
transfers/composer intake from leaking refused drafts
- own ONE recursive image walk (dsh-llm contentHasImage) across apiproxy,
pi-ai, compact-basic, and the DeepSeek text-only assertion
- drop the redundant canonical-base64 regex and the no-op role read
- move AttachmentId/AttachmentError out of types.ts (brand.ts/error.ts);
document why AttachmentError does not extend HarnessError
- document the hard attachments inject in both consumer READMEs
- llm-deepseek: the uncatalogued resolveModel fallback declares text-only
modalities — the wire route is text-only regardless of catalog
membership, so "unknown" must not let the host persist-then-fail images.
- session.selectModel also consults the pending-inbox mirror: a queued
image prompt enters the log only when claimed, after a switch would land.
- attachment store: ensureDurableDirectory syncs every ancestor entry up to
a caller-vouched boundary regardless of what mkdir reports — a raced
"already existed" is not "already durable".
- One image walker (imageBlockIn/imageInEvent) now serves both attachment
authorization and the selection gate; referencedImage therefore also
authorizes references inside wrapped message content.
- InputHub: the scope disposer resolves the conversation service optionally
(teardown/HMR must reach quiescence), and a send failing after its scope
died releases the in-flight drafts instead of restoring them onto a
disposed shell.
- http-bridge destroys declared-oversize requests with connection: close
instead of draining a body the client can trickle indefinitely.
- LlmService validates AND detaches modality arrays identically on the
advisory and exact routes; READMEs record the fourth INVALID_MODEL_INFO
rejection reason.
- CLI provider docs (JSDoc, README pair, Agent Note pair) describe the
reuse behavior; llm-route.spec now parses the SHIPPED cordis.yml through
the production extraction, pinning the row coupling.
- image-display lane pins gallery/rail shape in inline snapshots and the
object-URL scheme this environment must take; stale host.schema comment
dropped.
- resolveLlmRoute: reuse the yml pi-ai row for providers it already routes
(DUPLICATE_ADAPTER boot failure) and detect an unset model by origin, not
by comparison against one deployment default; covered by a new spec.
- LlmService.resolveModelInfoFor preserves (and validates) modality
metadata, arming the host image preflight for exact-route resolution.
- session.selectModel refuses a text-only target once the session log
carries an image on any replayed route; an accepted switch would strand
every later turn with no in-product recovery.
- The composer no longer gates image intake on the handshake activeModel
snapshot (wrong authority for a per-session decision); the host preflight
plus the error strip own capability, deployment limits stay client-side.
- InputHub shell teardown releases the scope's draft images (File objects
and object URLs leaked for the page lifetime).
- session.prompt image parts carry optional alt into the durable block;
ImageBlock documents assistant-side rendering as forward compatibility.
- Assembled built-client lane apps/web/tests/image-display.snapshot.ts pins
the history galleries over the authorized attachment route, the lightbox,
and the composer paste rail; the attachment rail is an accessible group.
- Docs: validateImage on the seam page, fixture byte metadata matches its
PNG, and the Agent Note claims now match the shipped coverage.
- host trio kept on the merged api-proxy: session.models (provider-grouped
advisory directory), session.selectModel (validated provider, advisory
model), installAgentLlmTarget threaded through create/resume/ensureSession;
the gateway declares the llm inject it reads
- history no longer piggybacks modelTarget: the current target travels on
session.models alone (the /model popup is the sole consumer)
- new @deepseek-ai/dsh-client-ui-model plugin: /model popupSelect over the
wire — options load the directory (group label in the detail column,
provider-local failures listed inline), onSelect routes selectModel;
failures ride the popup shell's error/retry surface
- ModelSelector package, conversation.composer.control slot, and the
Session-side modelSelection state machine are removed: model selection
belongs to the /model popup; the named conversation.input.model seat
stays empty until a control-seat entry is designed for it
